Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

So how would you set up e.g. a user or application process instance, especially where you might have multiple process instances? Also bearing in mind that things like JBOSS may have multiple instances only differentiated far along a long command line, is there any limit on the length of the command line that ITSI will have to inspect?

People who like this

1 Answer

Yes. We have a base search that creates an entity value based on two fields (a location code and a numeric value representing a specific place at that location) and then output the KPIs by that entity value. Then we link our entities to our service using a wild card - location-*

As long as you can match the KPI values from the base search to the entities in the service I think you can use whatever you want.